summaryrefslogtreecommitdiff
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/whawty/auth/store/tasks/sync-client.yml34
-rw-r--r--roles/whawty/auth/store/templates/systemd.service.j214
-rw-r--r--roles/whawty/auth/store/templates/systemd.timer.j211
3 files changed, 29 insertions, 30 deletions
diff --git a/roles/whawty/auth/store/tasks/sync-client.yml b/roles/whawty/auth/store/tasks/sync-client.yml
index 92657312..15b6f1ac 100644
--- a/roles/whawty/auth/store/tasks/sync-client.yml
+++ b/roles/whawty/auth/store/tasks/sync-client.yml
@@ -16,6 +16,9 @@
IdentityFile /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/id_ed25519
IdentitiesOnly yes
UserKnownHostsFile /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts
+ ControlMaster auto
+ ControlPath /run/ssh-master.whawty-auth-store-sync-{{ whawty_auth_store.name }}
+ ControlPersist 300
dest: "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/ssh_config"
- name: generate ssh keypair for sync client
@@ -24,22 +27,39 @@
type: ed25519
comment: "whawty-auth-sync-{{ whawty_auth_store.name }}@{{ inventory_hostname }}"
+- name: generate sync script
+ copy:
+ content: |
+ #!/bin/bash
+ {% set rsync_args = [] %}
+ {% if 'permissions' in whawty_auth_store %}
+ {% if 'file-mode' in whawty_auth_store.permissions %}
+ {% set _dummy = rsync_args.append(" --chmod=F"~whawty_auth_store.permissions['file-mode']) %}
+ {% endif %}
+ {% if 'owner' in whawty_auth_store.permissions %}
+ {% set _dummy = rsync_args.append(" --chown="~whawty_auth_store.permissions.owner~":"~whawty_auth_store.permissions.group) %}
+ {% endif %}
+ {% endif %}
+ while true; do
+ /usr/bin/rsync -rtW --delete --delete-delay --delay-updates --partial-dir=.tmp{{ rsync_args | join('') }} -e 'ssh -F "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/ssh_config"' 'rsync://whawty-auth-server/store' '{{ whawty_auth_store.config.basedir }}'
+ sleep 60
+ done
+ dest: /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/run.sh
+ mode: 0755
+
- name: generate known_hosts file
shell: "ssh-keyscan{% if 'port' in whawty_auth_store.sync %} -p {{ whawty_auth_store.sync.port }}{% endif %} {{ whawty_auth_store.sync.hostname }} > /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts"
args:
creates: "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts"
- name: install systemd units for whawty-auth store sync client
- loop:
- - service
- - timer
template:
- src: "systemd.{{ item }}.j2"
- dest: "/etc/systemd/system/whawty-auth-store-sync-{{ whawty_auth_store.name }}.{{ item }}"
+ src: "systemd.service.j2"
+ dest: "/etc/systemd/system/whawty-auth-store-sync-{{ whawty_auth_store.name }}.service"
-- name: make sure whawty-auth store sync client timer is enabled and started
+- name: make sure whawty-auth store sync client is enabled and started
systemd:
daemon_reload: yes
- name: "whawty-auth-store-sync-{{ whawty_auth_store.name }}.timer"
+ name: "whawty-auth-store-sync-{{ whawty_auth_store.name }}.service"
state: started
enabled: yes
diff --git a/roles/whawty/auth/store/templates/systemd.service.j2 b/roles/whawty/auth/store/templates/systemd.service.j2
index 5b1db6b2..2fe45642 100644
--- a/roles/whawty/auth/store/templates/systemd.service.j2
+++ b/roles/whawty/auth/store/templates/systemd.service.j2
@@ -1,19 +1,9 @@
-{% set rsync_args = [] %}
-{% if 'permissions' in whawty_auth_store %}
-{% if 'file-mode' in whawty_auth_store.permissions %}
-{% set _dummy = rsync_args.append(" --chmod=F"~whawty_auth_store.permissions['file-mode']) %}
-{% endif %}
-{% if 'owner' in whawty_auth_store.permissions %}
-{% set _dummy = rsync_args.append(" --chown="~whawty_auth_store.permissions.owner~":"~whawty_auth_store.permissions.group) %}
-{% endif %}
-{% endif %}
[Unit]
Description=sync for whawty-auth store {{ whawty_auth_store.name }}
[Service]
-Type=oneshot
-ExecStart=/usr/bin/rsync -rtW --delete --delete-delay --delay-updates --partial-dir=.tmp{{ rsync_args | join('') }} -e 'ssh -F "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/ssh_config"' 'rsync://whawty-auth-server/store' '{{ whawty_auth_store.config.basedir }}'
-TimeoutStartSec=40s
+Type=simple
+ExecStart=/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/run.sh
# systemd hardening-options
AmbientCapabilities=CAP_CHOWN CAP_FOWNER
diff --git a/roles/whawty/auth/store/templates/systemd.timer.j2 b/roles/whawty/auth/store/templates/systemd.timer.j2
deleted file mode 100644
index 603295a5..00000000
--- a/roles/whawty/auth/store/templates/systemd.timer.j2
+++ /dev/null
@@ -1,11 +0,0 @@
-[Unit]
-Description=sync for whawty-auth store {{ whawty_auth_store.name }}
-
-[Timer]
-OnBootSec=30s
-OnActiveSec=5s
-OnUnitActiveSec=1m
-AccuracySec=5s
-
-[Install]
-WantedBy=timers.target